Legal - Privacy policy

Who we are

Wardkey is a brand of Meridal Group LLC, a limited liability company registered in Wyoming, United States. Our testing team works in the European Union. Meridal Group LLC decides how personal data on this website and in our sales and billing records is used, so it is the controller of that data. For questions about this policy, email security@wardkeylabs.com.

What we collect

• Quote requests. Your name, work email, company, product URL, what you want tested, your timeline and any questionnaire you attach.
• Email and calls. What you write to us or tell us while we scope and run an engagement.
• Research by email. Your email address, if you subscribe.
• Billing. Company name, billing contact, address and tax details needed for invoices.
• Server logs. IP address, browser and the pages requested, kept by our hosting provider for security and for no more than 30 days.

We do not ask for sensitive data, and we ask you not to put customer data, passwords or keys in the quote form.

Why we use it

• To reply, prepare a quote and run the engagement you ask for (performing or preparing a contract).
• To send research you subscribed to (consent, which you can withdraw at any time).
• To invoice and keep accounting records (legal obligation).
• To protect this website and our systems from abuse (legitimate interest).

We do not sell personal data, we do not share it for advertising and we do not use it to train AI models.

Data we see during a test

When we test your systems, we work with test accounts and synthetic data. If personal data in your systems becomes visible to us, we process it only on your instructions, as your processor, under our data processing terms. It is never used for anything else.

Cookies

This website sets no tracking or advertising cookies and runs no ad pixels. If that changes, we will update this page first and ask for consent where the law requires it.

Who receives it

Only the service providers listed on our subprocessors page, each under a written agreement, and authorities where the law requires it.

International transfers

Our team works in the European Union and some of our providers are in the United States. Where personal data moves out of the European Economic Area, we rely on the EU Standard Contractual Clauses or on the provider's certification under the EU-US Data Privacy Framework.

How long we keep it

• Quote requests that do not lead to an engagement: 24 months, then deleted.
• Engagement correspondence and contracts: for the contract term plus 5 years.
• Invoices and accounting records: as long as tax law requires, usually 10 years.
• Test evidence and reports: as set out on our security page.
• Research subscribers: until you unsubscribe.

Your rights

You can ask to see, correct, delete or export your personal data, object to its use or restrict it, and withdraw consent at any time. California residents have the same rights under the CCPA and CPRA, and we do not sell or share personal information as those laws define it. Email security@wardkeylabs.com and we reply within 30 days. We will not treat you differently for using these rights.

If you are in the EU and are not satisfied with our answer, you can complain to the data protection authority in your country.

Security

Data is encrypted in transit and at rest, access is limited to the people who need it, and every account uses multi-factor authentication. If a breach affects your personal data, we will tell you and the regulator as the law requires.

Changes

We will post any change on this page with a new date. Material changes are also emailed to clients and subscribers.